CVE-2026-100151: kstover: The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is…

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring: ' URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and...

PT-2026-134497

Name of the Vulnerable Software and Affected Versions Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder versions prior to 3.15.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected DOM-Based...

CVE-2026-109770

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Web Serial component...

CVE-2026-109756

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...

CVE-2026-109734

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component...

CVE-2026-109744

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the DOM: File component...

CVE-2026-109745

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to uninitialized memory in the DOM: Web Serial component...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Technical analysis and defensive mitigation matrix for the CVE-2026-64638 XSS2Shell vector, a critical parsing inconsistency in the WordPress Core authentication screen that makes it possible to chain a reflected pre-authentication Cross-Site Scripting XSS with browser...

CVE-2026-109735

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Animation component...

CVE-2026-109724

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-109750

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the DOM: Web Authentication component...

CVE-2026-109746

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component...

VUL4J-59

jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...

WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin NextGEN Gallery versions = 4.5.4...

CVE-2026-109725

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-109728

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Animation component...

CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

WordPress User Submitted Posts – Enable Users to Submit Posts from the Front End plugin <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin User Submitted Posts versions = 20260916...

cve-2025-55182-lab

CVE-2025-55182 - React2Shell Lab Overview CVE-2025-55182 React2Shell is a CVSS 10.0 critical Unauthenticated Remote Code Execution RCE vulnerability in React Server Components RSC's Flight Protocol, affecting react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack packages...

CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day

XSS 0-Click / 0-Day Vulnerability Report Cross-Site Scripting 0-Click Leading to JavaScript Bridge Abuse in Pocket Android & iOS — CVSS 9.2 CRITICAL CVE-2026-82090 — Published by MITRE Corporation 2026-08-28 Author: Ing. Zampier Zago FUNFACTOR1 Division: Section 1 — Department of Cyber Security, ...